isc_miners.yml

gistfile1.txt

$ pip install csirtg-smrt
$ csirtg-smrt -r isc_miners.yml -d --format [bro|table|csv|...]

parser: json
remote: https://isc.sans.edu/api/threatlist/miner?json
defaults:
  provider: isc.sans.edu
  tlp: green
  altid_tlp: white
  application:
    - http
    - https
  confidence: 7
  tags:
    - botnet
    - bitcoin
  protocol: tcp
  description: 'bitcoin miner'
  altid: https://isc.sans.edu/api/threatlist/miner?json

feeds:
  urls:
    itype: ipv4
    map:
      - ipv4
      - lastseen
    values:
      - indicator
      - lasttime